autarch/data/ioc/spyware/mvt/indicators.yaml

indicators:
  -
    type: github
    name: NSO Group Pegasus Indicators of Compromise
    sources:
      - Amnesty International
    references:
      - https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/
    github:
      owner: AmnestyTech
      repo: investigations
      branch: master
      path: 2021-07-18_nso/pegasus.stix2

  -
    type: github
    name: Predator Spyware Indicators of Compromise
    sources:
      - Meta
      - Amnesty International
      - Citizen Lab
      - Cisco
      - Inside Story
      - iVerify
    references:
      - https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/
      - https://about.fb.com/news/2021/12/taking-action-against-surveillance-for-hire/
      - https://blog.talosintelligence.com/mercenary-intellexa-predator/
      - https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/
      - https://insidestory.gr/article/predatorgate-ti-egrafan-ta-sms-pagida-poy-elavan-epiheirimaties-ypoyrgoi-kai-dimosiografoi
      - https://iverify.io/blog/trust-broken-at-the-core
    github:
      owner: mvt-project
      repo: mvt-indicators
      branch: main
      path: intellexa_predator/predator.stix2

  -
    type: github
    name: RCS Lab Spyware Indicators of Compromise
    sources:
      - Google
      - Lookout
    references:
      - https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan/
    github:
      owner: mvt-project
      repo: mvt-indicators
      branch: main
      path: 2022-06-23_rcs_lab/rcs.stix2

  -
    type: github
    name: Stalkerware Indicators of Compromise
    sources:
      - ECHAP
    references:
      - https://github.com/AssoEchap/stalkerware-indicators
    github:
      owner: AssoEchap
      repo: stalkerware-indicators
      branch: master
      path: generated/stalkerware.stix2

  -
    type: github
    name: Surveillance campaign linked to mercenary spyware company
    sources:
      - Amnesty International
      - Google
    references:
      - https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/
      - https://www.amnesty.org/en/latest/news/2023/03/new-android-hacking-campaign-linked-to-mercenary-spyware-company/
    github:
      owner: AmnestyTech
      repo: investigations
      branch: master
      path: 2023-03-29_android_campaign/malware.stix2

  -
    type: github
    name: Quadream KingSpawn Indicators of Compromise
    sources:
      - Citizen Lab
      - Microsoft
    references:
      - https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/
      - https://www.microsoft.com/en-us/security/blog/2023/04/11/dev-0196-quadreams-kingspawn-malware-used-to-target-civil-society-in-europe-north-america-the-middle-east-and-southeast-asia/
    github:
      owner: mvt-project
      repo: mvt-indicators
      branch: main
      path: 2023-04-11_quadream/kingspawn.stix2

  -
    type: github
    name: Operation Triangulation Indicators of Compromise
    sources:
      - Kaspersky Lab
    references:
      - https://securelist.com/operation-triangulation/109842/
    github:
      owner: mvt-project
      repo: mvt-indicators
      branch: main
      path: 2023-06_01_operation_triangulation/operation_triangulation.stix2

  -
    type: github
    name: WyrmSpy and DragonEgg Indicators of Compromise
    sources:
      - Lookout
    references:
      - https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41
    github:
      owner: mvt-project
      repo: mvt-indicators
      branch: main
      path: 2023-07-25_wyrmspy_dragonegg/wyrmspy_dragonegg.stix2

  -
    type: github
    name: Wintego Helios Indicators of Compromise
    sources:
      - Amnesty International
    references:
      - https://securitylab.amnesty.org/latest/2024/05/a-web-of-surveillance/
    github:
      owner: AmnestyTech
      repo: investigations
      branch: master
      path: 2024-05-02_wintego_helios/wintego_helios.stix2

  -
    type: github
    name: NoviSpy (Serbia) Indicators of Compromise
    sources:
      - Amnesty International
    references:
      - https://securitylab.amnesty.org/latest/2024/12/serbia-a-digital-prison-spyware-and-cellebrite-used-on-journalists-and-activists/
    github:
      owner: AmnestyTech
      repo: investigations
      branch: master
      path: 2024-12-16_serbia_novispy/novispy.stix2

  -
    type: github
    name: Candiru (DevilsTongue) Indicators of Compromise
    sources:
      - Microsoft
      - Recorded Future
    references:
      - https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
      - https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware
    github:
      owner: mvt-project
      repo: mvt-indicators
      branch: main
      path: candiru/candiru.stix2

  -
    type: github
    name: ResidentBat Indicators of Compromise
    sources:
      - Reporters Without Borders
      - RESIDENT.NGO
    references:
      - https://rsf.org/en/exclusive-rsf-uncovers-new-spyware-belarus
      - https://rsf.org/sites/default/files/medias/file/2025/12/report.pdf
    github:
      owner: mvt-project
      repo: mvt-indicators
      branch: main
      path: ResidentBat/residentbat.stix2

  -
    type: github
    name: Cellebrite Indicators of Compromise
    sources:
      - Citizen Lab
    references:
      - https://citizenlab.ca/research/from-protest-to-peril-cellebrite-used-against-jordanian-civil-society/
    github:
      owner: mvt-project
      repo: mvt-indicators
      branch: main
      path: cellebrite/cellebrite.stix2